Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    mouse_2.exe
  • Size 984KB
  • SHA256 03968a3a5a7a880feefca31686fcfbed445080a0c06eda2b6d623757179b782c
  • MD5 af8ab92992ccc4cc6a637953836edf93
  • SHA1 ac17c77cae31fdfeb618b0083285ba869baf29fc
  • SHA512 9dc3bdfe45f9333d62ef3b0aaf3860a9ef1e94ced02ed0437d3ac2f96b3b9aacf6e621703f13d62f356bd50dec84cc3a3dc787a8a14c9ce0ceeed9ff63c45ad2
  • SSDEEP 24576:iNg+tKkEYA7Gmvv/HGsvPw9vz/DrELE7VUH:0g4K7YA7vvRMbcLa
  • TLSH
    T1AC25010436C2AD5FC33E8DB644971810ABB091677E1BF343ADCB21DA252DFC60A55B9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencerezer0spywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • Masslogger family

    masslogger

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    openme.exe
  • Size 756KB
  • SHA256 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
  • MD5 d6408ae6bf86b97eadfb3f15bbfd7933
  • SHA1 dd877b59c9acd80535ad22bdc07525d536a41139
  • SHA512 f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec
  • SSDEEP 12288:Gh6IrzSS5jAVxdzI/YraGvkDbjjiraX2u:66IHS0ePk/oaDSaX
  • TLSH
    T154F47D22F791BC44FC5240302B55D6A62458687AE152894BFB4CDF6E7B709C3B8FA70B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdiscoverytrickbottrojan

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot family

    trickbot
  behavioral3behavioral4
• • Target
    senate.m4a
  • Size 575KB
  • SHA256 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
  • MD5 8bdb30d9f3c697d3f12aea9dd3d83a60
  • SHA1 f89fc63457ce4914b5e41ed0b17af0a9e1ac6119
  • SHA512 bc7f688736b607baea107ea20d1e6686aed9619b7f10b81b95a74ac652c09696a83160f603c5b106498643c10c8eb60572ffbdcd23db6c12e68c15d9dec5f905
  • SSDEEP 3072:1YkPy807G4DQRGSiZ+LwbUcsNTJiFJwjjeh2ULOgKNIfvqoaAUk/vQExVxynJf0m:FPyH7l+4sdJeJoW4gO6q2vfLxyZ
  • TLSH
    T1A2C45AE5A2534857EC6E2D710EF95E037219BC70A4751BBE21DB3B4E8931D883E71A0E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetspx139spx139discoveryzloadertrojan

  • Zloader family

    zloader

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  behavioral5behavioral6
• • Target
    update.exe
  • Size 12.0MB
  • SHA256 3e32145dca0843c6d5258129821afaaeb653ddef7982912fe85ad4b326807402
  • MD5 c5c8d4f5d9f26bac32d43854af721fb3
  • SHA1 e4119a28baa102a28ff9b681f6bbb0275c9627c7
  • SHA512 09f39bccb210f96788193d597463c75d3213afd21ed93ac8c843f150d7cb8630f941f54cd8737cc88177dadeb479e8181b40a7f5219e40c948ff18d1955b4828
  • SSDEEP 196608:/CKcbhJ7Th2zINlZGI4KXt8ioZR4KVl8e/BGZfsKu97K1RdF4N/55H+oHVdxv:6f/xG+ifj4KVBZGZfKMP4X5eGXxv
  • TLSH
    T1A9C63312A3E28026FF9A92734F50F646ABBD38394533D52F53581EB97D700A0267E763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2defense_evasiondiscoveryexecutionrmsxmriglateral_movementminerpersistenceprivilege_escalationrattrojanupx

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • Rms family

    rms

  • Windows security bypass

    defense_evasiontrojan

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Modifies visibility of existing users in the login screen

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7behavioral8
• • Target
    wwf[1].exe
  • Size 2.3MB
  • SHA256 0263c76856472535f8441f582dac011dbf52f965086f9e59a6930c00b2106073
  • MD5 f18334d87221ecb0fb12405814c21912
  • SHA1 2875140558c0c17a259ff2d731e5e4a0a823108a
  • SHA512 fa96425f2402803b7c34ea27211c33257224f65966cb42c651fa688bc131bbae6dbf7fc743eb055398fc2e4a0841a17ff31097346c4666ba39607e974c22ae2d
  • SSDEEP 49152:jUEJpE+TT7TDGBcuHsi7Ly2Cr2SRtgbR9iTp1woifnUWtMbuIJ0y:jBnE+TT/DGTHs8yVr2n99iTpiXfnUWtS
  • TLSH
    T1AEB5CF32798184B6C1730771EE0DB36963ACB8700E34974772A49E6D2FB04936A6DBD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetbot7bot7discoveryzloaderpersistencetrojan

  • Zloader family

    zloader

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral10behavioral9
• • Target
    xNet.dll
  • Size 99KB
  • SHA256 5d9c2b1822bcaa71ddeaa5426d4312d8e174766ae8864c7add29d7f44cea87f2
  • MD5 bf1f76644bddd20339548ebacf7a48eb
  • SHA1 38114702114105eb3df3f74bf4c68ef7db436f47
  • SHA512 76132c9e29a0a3054cd41c56d5184951d392a2abd1995e14b34c40f14b154914a6990c107e7fcf4139344759ae6048e9ecf0bdaf0447c1cd589dfacbf901b7c5
  • SSDEEP 3072:sCMhzHWHfyqxjqCgRGAQIO7ScwpY3wisz0YsXhqnV+xnEd4:sCM52n4RSVPwIhqnV+xnEd
  • TLSH
    T161A32A1437FE595BF7EF4778E470111443BAB9A92207CB6E1C5474AF08A2B908950FB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
  • Size 545KB
  • SHA256 291f381da3286ea93c38bb325e19f35744349c3543708135d8be731f4bafb6e2
  • MD5 54bef758433c98353b61bf1e2aecefb2
  • SHA1 06feb43c6d58eab893396f63aa2e1d0e4542f7d1
  • SHA512 3bfb51f9bee7033ebde0f418b88327b7c7a322b3e0572d92ad4cdf37c9fbed22d518c9ce2d8d5638381542bef83077d8054184b9f613b815df6906a99fd4526f
  • SSDEEP 12288:fPT9h+l+ofoa/sHoNFU9Zd1jWOYE9QjmJl/2hgDMjhP:fPT9hifJKZd1jWOY2emPOuDMd
  • TLSH
    T138C4F102F390D961DD7B49308B7ADEF0162FB8B14E74665623A46A1F2EB01D1993B31F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  276discoveryvidarspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Vidar Stealer

    stealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral13behavioral14
• • Target
    전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
  • Size 228KB
  • SHA256 aaf7bb9ad358726ca367f1827686dc15fea925f26ab1e201a2768c67472e8890
  • MD5 8399865e44e7d6a193f8c8acf547eb31
  • SHA1 17e3bee5debada69dadec0b748256925a1a8b1ac
  • SHA512 bf9ceb3a36ca874dceb9ccfec8e7635f5f11f83f04226ceb4e2b4b2548dbcecf2618fe5063bec068b1571867984d0beece6b5f9be0747a13ddb53f9a09aa4d61
  • SSDEEP 3072:tPTcPP3LvQjfIY9Spek01stm+XIm1EWaVw3ItNVFZUyfUNjhb+P0I1fcj:tPTcPfL43SW1stDXaXw3ItNVTUVjhGy
  • TLSH
    T131348D42B3D0D861EDBB4E304B3ADEB0162FB9B19D74664723546A1F2DB11D2893B60F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionmakopimpactpersistenceransomwarespywarestealer

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Makop family

    makop

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (9841) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral15behavioral16